Terrorist Financing: The Mumbai Bombing, a Case Study in the Possible and Probable
Dennis M. Lormel 7/31/2014
Overview
Between November 26 and 28, 2008, the world was riveted by an extremely well planned and executed terrorist attack in Mumbai, India. The Pakistani based group Lashkar-e-Taiba (LeT) carried out the attack. Ten terrorists, deployed as two man teams, attacked five unsuspecting venues with near simultaneous precision. They killed 166 individuals and wounded 308 others. There were untold hostages and people in hiding within certain attack locations. As a result of the ensuing chaos, confusion and lack of adequate intelligence, there was an agonizing three day standoff between the terrorists, law enforcement, counterterrorism and military authorities.
LeT experienced resounding success in capturing worldwide attention during the siege and in its aftermath. By the time authorities controlled the situation, nine of the ten terrorist operatives were dead, along with their victims. The tenth LeT operative was captured. The world was stunned and country by country they looked inward for similar attack vulnerabilities.
Since Mumbai, there have been many exhaustive intelligence assessments of the violence and vulnerabilities associated with that attack. Numerous reports, containing extensive analysis for future intelligence purposes have been generated. Unfortunately, there is little reference to financial intelligence. How unfortunate!
Two of the most significant vulnerabilities to terrorist organizations, terrorist operatives and terrorist operations are finance and communications. A financial intelligence assessment of Mumbai would have yielded valuable financial intelligence for the intelligence community, law enforcement and more importantly for financial institutions. Yes, financial institutions. What the intelligence and law enforcement community must remember every time there is a 9/11 or a Mumbai is that financial institutions are the repository for the financial intelligence that will provide tangible investigative results before many other forms of intelligence.
Financial Institutions and Financial Intelligence: The Possible and the Probable
Financial institutions are the repositories of extensive financial and supporting documentation. This information is the source of valuable financial intelligence. Many financial institutions have established financial intelligence units. Others have designated personnel with financial intelligence responsibilities. These entities and individuals are responsible for analyzing internal and external data to identify and report suspicious activity, as well as other risk vulnerabilities to include terrorist financing.
From a financial institution standpoint, it is possible to identify terrorist financing. However, it is not probable. Wherever we can identify the possible and expand upon it through analysis of terrorist incidents such as Mumbai, we increase the prospect of making identification of terrorist activity more probable. Elements of the Mumbai attack provide patterns of activity that when assessed against financial intelligence enhance the probability of identifying red flags consistent with terrorist behavior.
The Terrorist Attack Cycle
Stratfor is a prominent and reliable private service that publishes intelligence reports, analysis and research for government, private industry and research institutions. In 2005, Stratfor published the terrorist attack cycle. It was released in six segments that identified the stages that aspiring terrorists must follow in order to have a successful attack. The six stages include:
1. Target selection
2. Planning (financing is an element of planning)
3. Deployment
4. Attack
5. Escape
6. Exploitation
The success achieved by LeT in carrying out the Mumbai attack demonstrates how well they followed the terrorist attack cycle. In late 2005, LeT leaders designated an LeT operative to travel to India to conduct surveillances to identify targets for an attack by other LeT operatives. A financial intelligence assessment regarding the activities of this terrorist operative would provide valuable insights identifying operational characteristics consistent with terrorist operatives. LeT’s application of the terrorist attack cycle was as follows:
Target Selection
An LeT operative traveled to Mumbai for five extended visits between May 2006 and July 2008. The operative established a business front as cover. He conducted extensive video surveillances of numerous locations. Ultimately, five locations were chosen for attack. This operative also took extensive surveillance videos of Mumbai harbor and purchased a GPS device to identify the route the attackers would take to reach Mumbai by water. Before and after each trip, the LeT surveillance operative met with LeT leaders in Pakistan to review, assess and select the five targets.
Planning
The attacks were meticulously planned by LeT leaders over a two year period. The surveillance operative was well trained and carefully chosen. The operation was funded by an officer from the Pakistani Inter-Services Intelligence Directorate (ISI). There was little mention of funding or the expenditure of funds in intelligence reports about the attack.
Initially, 32 LeT operatives received training in firearms, ammunition, grenades, and explosives. They were later trained to fire Kalashnikov rifles, 9 millimeter pistols and explosives. This group was pared down to 13 operatives. Six were chosen for other assignments. Three additional members were brought in. The 10 LeT operatives were thoroughly trained to conduct a terrorist attack. The 10 man group was told about the Mumbai operation in mid-September 2008. From that point forward, the group was isolated in a safe house in Karachi, Pakistan and cut off from any outside contact.
Deployment
The operatives left the safe house on November 22, 2008. They traveled by boat to Mumbai. They transferred from a small boat to an Indian fishing trawler that other LeT operatives had hijacked. The attack team left the trawler on November 26, 2008, near Mumbai harbor and traveled to shore in a rubber dinghy after receiving the go ahead from LeT leadership in Pakistan. Each operative had an ample supply of firearms, grenades and bombs. They carefully followed the planned route to shore in order to avoid detection.
Attack
The 10 LeT operatives broke into five two man teams and proceeded to the five target locations. The attackers were well coordinated and hit each selected attack target in close time proximity to each other. The attacks were a tactical surprise and initially met little resistance. Many of the victims who died were killed in the initial stages of the attack.
LeT leaders in Pakistan maintained command and control of the operation by telephone from Pakistan. They were in constant contact with four of the attack teams. The fifth team lost their satellite phone leaving the fishing trawler, did not appear to use cell phones and did not have contact with the LeT leaders in Pakistan. The command and control element monitored media coverage closely and kept the attackers informed about the positioning and movements of the Indian police and counterterrorism resources.
Escape
From the outset, the 10 attackers knew they were on a suicide mission. Therefore, escape was not required. By not being concerned about escape, the LeT operatives were more focused, destructive and vicious about their attack assignments.
Exploitation
LeT choreographed the attack to flaunt media attention with the success of the operation. LeT achieved widespread global media attention and coverage, causing worldwide fear and concern regarding similar style attacks. In addition, LeT succeeded at inflaming tensions between India and Pakistan.
The Mumbai Attack
Prior to the Mumbai attack, LeT was considered as a group that posed a regional threat. It was not considered a threat to the West. However, following the Mumbai attack, it was determined by intelligence agencies that LeT planned attacks in the West, to include the United States (U.S.). One attack was already in the planning stage. It was targeted for the Morgenavisen Jyllands-Posten newspaper in Denmark. The attack was to be in retaliation for the newspaper’s publication of cartoons depicting the Prophet Mohammed.
With respect to the Mumbai attack, LeT wanted to kill as many Westerners and Jews as it could. That factored into target selection. The targets chosen were:
· CST Railway Station
· Leopold Café and Bar
· Taj Mahal Hotel
· The Oberoi-Trident Hotel
· Chabad House
When the 10 LeT operatives landed on the shore of Mumbai harbor on the evening of November 26, 2008, they broke up into five groups in precision and proceeded to their assigned targets.
CST Railway Station is the headquarters of Central Railways. 3.5 million people pass through the station on a daily basis. At 9:20 PM, one LeT team entered the CST Railway Station and began to indiscriminately fire their weapons and lob grenades. The carnage resulted in 58 dead and 104 injured. These two operatives had lost their satellite phone, did not appear to use cell phones and did not have contact with the LeT leaders command and control operation in Pakistan. Consequently, they left the station and stole a vehicle following a shootout with police. They were ultimately confronted at a police checkpoint. One of the terrorists was killed and one captured.
The Leopold Café and Bar was established in 1871. It was a popular venue frequented by foreigners and Indians. At 9:40 PM, an LeT team entered the Leopold and started firing their weapons indiscriminately. One grenade was lobbed and exploded. Ten individuals were killed and many injured. The two attackers left the Leopold within minutes and ran toward the Taj Mahal Hotel.
The Taj Mahal Hotel was constructed in 1903. The hotel had 565 rooms. It is an icon in Mumbai. The first two terrorists entered the main lobby of the Taj Mahal at 9:38 PM. They opened fire and killed 20 people within minutes. The second pair of terrorists, who came from the Leopold, entered the Taj Mahal at 9:43 PM. They fired indiscriminately and hurled grenades. The four terrorists went to the sixth floor of the hotel killing anyone who came in their way. They set fire to part of the hotel. There was a hostage situation. In addition, many guests were hiding in their rooms. The four terrorists remained in constant telephonic contact with their leaders in the command and control facility in Pakistan. At the end of the standoff, on November 28th, the four terrorists were killed.
The Oberoi-Trident Hotel had 877 rooms. At 10:00 PM two LeT operatives entered the main lobby of the Trident and started firing indiscriminately. They crossed over to the Oberoi, killing guests and staff who came in their way. They sprayed bullets into a restaurant. They went to the 16th floor of the Oberoi where they held many guests hostage. The two terrorists remained in constant telephonic contact with their controllers in Pakistan. On the afternoon of November 28th, the two terrorists were killed.
The Chabad House was a five story building owned by an orthodox Jewish organization called Chabad Liberation Movement of Hasidic Jews. At 10:25 PM, two terrorists began firing outside the building. They gained access to the building and took several people hostage. The two LeT operatives engaged in gun fire with police beginning on the 26th and lasting into the 27th. They were in constant telephonic contact with their controllers in Pakistan. The two terrorists were killed on the 27th. Five hostages were found dead, killed by the terrorists.
David Coleman Headley: The U.S. Connection
David Coleman Headley was born Daood Gilani. He was born in Washington, D.C. His father was a famous Pakistani broadcaster. His mother was from a wealthy Philadelphia family. The family moved to Pakistan when Headley was a baby. Headley grew up in Pakistan. His parents divorced and his mother returned to Philadelphia. Headley moved back to live with his mother when he was 17. He traveled frequently between the U.S. and Pakistan.
Headley joined the LeT. He attended LeT training camps on five separate occasions in 2002 and 2003. The training Headley received included:
· February 2002 Three week course Indoctrination on the merits of waging jihad
· August 2002 Three week course Training in use of weapons and grenades
· April 2003 Three month course Training on combat tactics and survival
· August 2003 Three week course Training in counter-surveillance
· December 2003 Three month course Combat and tactical training
In 2005, Headley was selected by Sajid Mir, an LeT leader, and Major Iqbal, of the ISI, to travel to India to conduct surveillances of potential targets for a terrorist attack. Headley’s principal residence was located in Chicago, Illinois, but he travelled frequently to Pakistan. In February 2006, Headley changed his name from Doaood Gilani to David Coleman Headley. This would enable him to portray himself in India as an American and not a Muslim or Pakistani. In June 2006, Headley’s longtime friend Tahawwur Hussain Rana allowed Headley to use his immigration company First World Immigration as a front to cover Headley’s surveillance activities in Mumbai.
Between September 2006, and July 2008, Headley took five extended trips to Mumbai where he conducted extensive video surveillances. Prior to and after each of these trips, Headley met with his LeT and ISI handlers in Pakistan regarding his surveillance activity and target selection.
Prior to the Mumbai attacks, in early November 2008, Headley began to conduct target surveillances of the Morganevisen Jyllands-Posten newspaper at two locations in Denmark. In early August 2009, Headley traveled to Copenhagen, Denmark to conduct additional surveillance of the newspaper. He took approximately 13 surveillance videos. He returned to the U.S. on or about August 5th. On October 3, 2009, Headley was arrested by the FBI at Chicago O’Hare Airport. He was preparing to travel to Pakistan to meet with Mir and Major Iqbal to provide them with the 13 surveillance videos.
Headley was arrested for his activities regarding the planned attack in Denmark. Subsequently, he was linked to the Mumbai attack. Headley was indicted for his involvement in the Mumbai attack and for his involvement in the planned attack in Denmark. Following his arrest, Headley cooperated with the FBI. He provided evidence against other conspirators in both plots. Headley pled guilty to charges against him and testified against other subjects.
Lessons Learned for Financial Institutions: Red Flags Regarding David Chase Headley
Let’s assume that being a U.S. citizen, whose primary domicile was Chicago, Illinois, David Chase Headley banked with one or more U.S. banks. From a financial institution perspective, the Mumbai attack provides many nuggets of financial intelligence. It begins well before the attack with the activity of Headley. Many of the red flags identifiable with Headley are the same flags identifiable with other terrorist operatives in this case, as well in many other terrorism cases.